From 24f60579bc70a94e29256b92f81f6b7e3a85f1b8 Mon Sep 17 00:00:00 2001
From: guy <guy>
Date: Sun, 15 Oct 2006 18:20:26 +0000
Subject: From Paolo Abeni:

	The attached patch fix an off by one in current usb sniffing
	code.  It also substitute the kernel-provided timestamp with
	gettimeofday.  The kernel provided timestamp use 32 bits to
	represent a struct timeval (8 bits for tv_sec and 24 for
	tv_usec), so it's content is quite misleading.
---
 pcap-usb-linux.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

(limited to 'pcap-usb-linux.c')

diff --git a/pcap-usb-linux.c b/pcap-usb-linux.c
index f01a28b..29d7ba7 100644
--- a/pcap-usb-linux.c
+++ b/pcap-usb-linux.c
@@ -241,8 +241,15 @@ usb_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *u
 	uhdr->endpoint_number = htonl(ep_num);
 	uhdr->device_address = htonl(dev_addr);
 	string += cnt;
-	pkth.ts.tv_sec = timestamp / 1000000;
-	pkth.ts.tv_usec = timestamp % 1000000;
+
+	/* don't use usbmon provided timestamp, since it have low precision*/
+	if (gettimeofday(&pkth.ts, NULL) < 0) 
+	{
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			"Can't get timestamp for message '%s' %d:%s", 
+			string, errno, strerror(errno));
+		return -1;
+	}
 	
 	/* parse endpoint information */
 	if (pipeid1 == 'C')
@@ -353,6 +360,9 @@ usb_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *u
 	if (urb_tag != '=')
 	    	goto got;
 	
+	/* skip urb tag and following space */
+	string += 3;
+	
 	/* read all urb data; if urb length is greater then the usbmon internal 
 	 * buffer length used by the kernel to spool the URB, we get only
 	 * a partial information.
-- 
cgit v1.2.3